CVE-2021-32719

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the `rabbitmq_federation_management` plugin, its consumer tag was rendered without proper <script> tag sanitization. This potentially allows for JavaScript code execution in the context of the page. The user must be signed in and have elevated permissions (manage federation upstreams and policies) for this to occur. The vulnerability is patched in RabbitMQ 3.8.18. As a workaround, disable the `rabbitmq_federation_management` plugin and use [CLI tools](https://www.rabbitmq.com/cli.html) instead.

• CWE-80
• CWE-79

• https://github.com/rabbitmq/rabbitmq-server/pull/3122Patch, Third Party Advisory
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5452-hxj4-773xMitigation, Third Party Advisory
• https://herolab.usd.de/security-advisories/usd-2021-0011/Exploit, Third Party Advisory
• https://github.com/rabbitmq/rabbitmq-server/pull/3122Patch, Third Party Advisory
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5452-hxj4-773xMitigation, Third Party Advisory
• https://herolab.usd.de/security-advisories/usd-2021-0011/Exploit, Third Party Advisory

Published

Jun 28, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32713Shopware is an open source eCommerce platform. Versions prio…4.8
• CVE-2021-32714hyper is an HTTP library for Rust. In versions prior to 0.14…9.1
• CVE-2021-32715hyper is an HTTP library for rust. hyper's HTTP/1 server cod…5.3
• CVE-2021-32716Shopware is an open source eCommerce platform. In versions p…4.9
• CVE-2021-32717Shopware is an open source eCommerce platform. In versions p…7.5
• CVE-2021-32718RabbitMQ is a multi-protocol messaging broker. In rabbitmq-s…5.4
• CVE-2021-3272jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 ha…5.5
• CVE-2021-32720Sylius is an Open Source eCommerce platform on top of Symfon…5.3
• CVE-2021-32721PowerMux is a drop-in replacement for Go's http.ServeMux. In…6.1
• CVE-2021-32722GlobalNewFiles is a mediawiki extension. Versions prior to 4…6.5
• CVE-2021-32723Prism is a syntax highlighting library. Some languages befor…6.5
• CVE-2021-32724check-spelling is a github action which provides CI spell ch…9.9